qm.conf

package: pve-qemu-server

title: qm.conf(5)

text:
# qm.conf(5)

## NAME
qm.conf - Proxmox VE Virtual Machine Configuration

## SYNOPSIS
/etc/pve/qemu-server/<VMID>.conf

## DESCRIPTION
The /etc/pve/qemu-server/<VMID>.conf files stores VM configuration, where "VMID" is the numeric ID of the given VM.

Note IDs < 100 are reserved for internal purposes.

## FILE FORMAT
The file uses a simple colon separated key/value format. Each line has the following format:

```
OPTION: value
```

Blank lines in the file are ignored, and lines starting with a # character are treated as comments and are also ignored.

One can use the qm command to generate and modify those files.

## OPTIONS
acpi: <boolean> (default = 1)

Enable/disable ACPI.

affinity: <string>

List of host cores used to execute guest processes, for example: 0,5,8-11

agent: [enabled=]<1|0> [,freeze-fs-on-backup=<1|0>] [,fstrim_cloned_disks=<1|0>] [,type=<virtio|isa>]

Enable/disable communication with the QEMU Guest Agent and its properties. enabled=<boolean> (default = 0)

Enable/disable communication with a QEMU Guest Agent (QGA) running in the VM.

freeze-fs-on-backup=<boolean> (default = 1)

Freeze/thaw guest filesystems on backup for consistency.

fstrim_cloned_disks=<boolean> (default = 0)

Run fstrim after moving a disk or migrating the VM.

type=<isa | virtio> (default = virtio)

Select the agent type

arch: <aarch64 | x86_64>

Virtual processor architecture. Defaults to the host.

args: <string>

Arbitrary arguments passed to kvm, for example: args: -no-reboot -no-hpet

Note

this option is for experts only.

audio0: device=<ich9-intel-hda|intel-hda|AC97> [,driver=<spice|none>]

Configure a audio device, useful in combination with QXL/Spice. device=<AC97 | ich9-intel-hda | intel-hda>

Configure an audio device.

driver=<none | spice> (default = spice)

Driver backend for the audio device.

autostart: <boolean> (default = 0)

Automatic restart after crash (currently ignored).

balloon: <integer> (0 - N)

Amount of target RAM for the VM in MiB. Using zero disables the ballon driver.

bios: <ovmf | seabios> (default = seabios)

Select BIOS implementation.

boot: [[legacy=]<[acdn]{1,4}>] [,order=<device[;device...]>]

Specify guest boot order. Use the order= sub-property as usage with no key or legacy= is deprecated. legacy=<[acdn]{1,4}> (default = cdn)

Boot on floppy (a), hard disk (c), CD-ROM (d), or network (n). Deprecated, use order= instead.

order=<device[;device...]>

The guest will attempt to boot from devices in the order they appear here. Disks, optical drives and passed-through storage USB devices will be directly booted from, NICs will load PXE, and PCIe devices will either behave like disks (e.g. NVMe) or load an option ROM (e.g. RAID controller, hardware NIC).

Note that only devices in this list will be marked as bootable and thus loaded by the guest firmware (BIOS/UEFI). If you require multiple disks for booting (e.g. software-raid), you need to specify all of them here.

Overrides the deprecated legacy=[acdn]* value when given.

bootdisk: (ide|sata|scsi|virtio)\d+

Enable booting from specified disk. Deprecated: Use boot: order=foo;bar instead.

cdrom: <volume>

This is an alias for option -scsi7

cicustom: [meta=<volume>] [,network=<volume>] [,user=<volume>] [,vendor=<volume>]

cloud-init: Specify custom files to replace the automatically generated ones at start. meta=<volume>

Specify a custom file containing all meta data passed to the VM via" ." cloud-init. This is provider specific meaning configdrive2 and nocloud differ.

network=<volume>

To pass a custom file containing all network data to the VM via cloud-init.

user=<volume>

To pass a custom file containing all user data to the VM via cloud-init.

vendor=<volume>

To pass a custom file containing all vendor data to the VM via cloud-init.

cipassword: <string>

cloud-init: Password to assign the user. Using this is generally not recommended. Use ssh keys instead. Also note that older cloud-init versions do not support hashed passwords.

citype: <configdrive2 | nocloud | opennebula>

Specifies the cloud-init configuration format. The default depends on the configured operating system type (ostype. We use the nocloud format for Linux, and configdrive2 for windows.

ciuser: <string>

cloud-init: User name to change ssh keys and password for instead of the image’s configured default user.

cores: <integer> (1 - N) (default = 1)

The number of cores per socket.

cpu: [[cputype=]<string>] [,flags=<+FLAG[;-FLAG...]>] [,hidden=<1|0>] [,hv-vendor-id=<vendor-id>] [,phys-bits=<8-64|host>] [,reported-model=<enum>]

Emulated CPU type. cputype=<string> (default = kvm64)

Emulated CPU type. Can be default or custom name (custom model names must be prefixed with custom-).

flags=<+FLAG[;-FLAG...]>

List of additional CPU flags separated by ;. Use +FLAG to enable, -FLAG to disable a flag. Custom CPU models can specify any flag supported by QEMU/KVM, VM-specific flags must be from the following set for security reasons: pcid, spec-ctrl, ibpb, ssbd, virt-ssbd, amd-ssbd, amd-no-ssb, pdpe1gb, md-clear, hv-tlbflush, hv-evmcs, aes

hidden=<boolean> (default = 0)

Do not identify as a KVM virtual machine.

hv-vendor-id=<vendor-id>

The Hyper-V vendor ID. Some drivers or programs inside Windows guests need a specific ID.

phys-bits=<8-64|host>

The physical memory address bits that are reported to the guest OS. Should be smaller or equal to the host’s. Set to host to use value from host CPU, but note that doing so will break live migration to CPUs with other values.

reported-model=<486 | Broadwell | Broadwell-IBRS | Broadwell-noTSX | Broadwell-noTSX-IBRS | Cascadelake-Server | Cascadelake-Server-noTSX | Conroe | EPYC | EPYC-IBPB | EPYC-Milan | EPYC-Rome | Haswell | Haswell-IBRS | Haswell-noTSX | Haswell-noTSX-IBRS | Icelake-Client | Icelake-Client-noTSX | Icelake-Server | Icelake-Server-noTSX | IvyBridge | IvyBridge-IBRS | KnightsMill | Nehalem | Nehalem-IBRS | Opteron_G1 | Opteron_G2 | Opteron_G3 | Opteron_G4 | Opteron_G5 | Penryn | SandyBridge | SandyBridge-IBRS | Skylake-Client | Skylake-Client-IBRS | Skylake-Client-noTSX-IBRS | Skylake-Server | Skylake-Server-IBRS | Skylake-Server-noTSX-IBRS | Westmere | Westmere-IBRS | athlon | core2duo | coreduo | host | kvm32 | kvm64 | max | pentium | pentium2 | pentium3 | phenom | qemu32 | qemu64> (default = kvm64)

CPU model and vendor to report to the guest. Must be a QEMU/KVM supported model. Only valid for custom CPU model definitions, default models will always report themselves to the guest OS.

cpulimit: <number> (0 - 128) (default = 0)

Limit of CPU usage.

Note

If the computer has 2 CPUs, it has total of 2 CPU time. Value 0 indicates no CPU limit.

cpuunits: <integer> (1 - 262144) (default = cgroup v1: 1024, cgroup v2: 100)

CPU weight for a VM. Argument is used in the kernel fair scheduler. The larger the number is, the more CPU time this VM gets. Number is relative to weights of all the other running VMs.

description: <string>

Description for the VM. Shown in the web-interface VM’s summary. This is saved as comment inside the configuration file.

efidisk0: [file=]<volume> [,efitype=<2m|4m>] [,format=<enum>] [,pre-enrolled-keys=<1|0>] [,size=<DiskSize>]

Configure a disk for storing EFI vars. efitype=<2m | 4m> (default = 2m)

Size and type of the OVMF EFI vars. 4m is newer and recommended, and required for Secure Boot. For backwards compatibility, 2m is used if not otherwise specified. Ignored for VMs with arch=aarc64 (ARM).

file=<volume>

The drive’s backing volume.

format=<cloop | cow | qcow | qcow2 | qed | raw | vmdk>

The drive’s backing file’s data format.

pre-enrolled-keys=<boolean> (default = 0)

Use am EFI vars template with distribution-specific and Microsoft Standard keys enrolled, if used with efitype=4m. Note that this will enable Secure Boot by default, though it can still be turned off from within the VM.

size=<DiskSize>

Disk size. This is purely informational and has no effect.

freeze: <boolean>

Freeze CPU at startup (use c monitor command to start execution).

hookscript: <string>

Script that will be executed during various steps in the vms lifetime.

hostpci[n]: [host=]<HOSTPCIID[;HOSTPCIID2...]> [,device-id=<hex id>] [,legacy-igd=<1|0>] [,mdev=<string>] [,pcie=<1|0>] [,rombar=<1|0>] [,romfile=<string>] [,sub-device-id=<hex id>] [,sub-vendor-id=<hex id>] [,vendor-id=<hex id>] [,x-vga=<1|0>]

Map host PCI devices into guest.

Note

This option allows direct access to host hardware. So it is no longer possible to migrate such machines - use with special care.

Caution

Experimental! User reported problems with this option.

device-id=<hex id>

Override PCI device ID visible to guest

host=<HOSTPCIID[;HOSTPCIID2...]>

Host PCI device pass through. The PCI ID of a host’s PCI device or a list of PCI virtual functions of the host. HOSTPCIID syntax is: bus:dev.func (hexadecimal numbers)

You can us the lspci command to list existing PCI devices.

legacy-igd=<boolean> (default = 0)

Pass this device in legacy IGD mode, making it the primary and exclusive graphics device in the VM. Requires pc-i440fx machine type and VGA set to none.

mdev=<string>

The type of mediated device to use. An instance of this type will be created on startup of the VM and will be cleaned up when the VM stops.

pcie=<boolean> (default = 0)

Choose the PCI-express bus (needs the q35 machine model).

rombar=<boolean> (default = 1)

Specify whether or not the device’s ROM will be visible in the guest’s memory map.

romfile=<string>

Custom pci device rom filename (must be located in /usr/share/kvm/).

sub-device-id=<hex id>

Override PCI subsystem device ID visible to guest

sub-vendor-id=<hex id>

Override PCI subsystem vendor ID visible to guest

vendor-id=<hex id>

Override PCI vendor ID visible to guest

x-vga=<boolean> (default = 0)

Enable vfio-vga device support.

hotplug: <string> (default = network,disk,usb)

Selectively enable hotplug features. This is a comma separated list of hotplug features: network, disk, cpu, memory, usb and cloudinit. Use 0 to disable hotplug completely. Using 1 as value is an alias for the default network,disk,usb. USB hotplugging is possible for guests with machine version >= 7.1 and ostype l26 or windows > 7.

hugepages: <1024 | 2 | any>

Enable/disable hugepages memory.

ide[n]: [file=]<volume> [,aio=<native|threads|io_uring>] [,backup=<1|0>] [,bps=<bps>] [,bps_max_length=<seconds>] [,bps_rd=<bps>] [,bps_rd_max_length=<seconds>] [,bps_wr=<bps>] [,bps_wr_max_length=<seconds>] [,cache=<enum>] [,cyls=<integer>] [,detect_zeroes=<1|0>] [,discard=<ignore|on>] [,format=<enum>] [,heads=<integer>] [,iops=<iops>] [,iops_max=<iops>] [,iops_max_length=<seconds>] [,iops_rd=<iops>] [,iops_rd_max=<iops>] [,iops_rd_max_length=<seconds>] [,iops_wr=<iops>] [,iops_wr_max=<iops>] [,iops_wr_max_length=<seconds>] [,mbps=<mbps>] [,mbps_max=<mbps>] [,mbps_rd=<mbps>] [,mbps_rd_max=<mbps>] [,mbps_wr=<mbps>] [,mbps_wr_max=<mbps>] [,media=<cdrom|disk>] [,model=<model>] [,replicate=<1|0>] [,rerror=<ignore|report|stop>] [,secs=<integer>] [,serial=<serial>] [,shared=<1|0>] [,size=<DiskSize>] [,snapshot=<1|0>] [,ssd=<1|0>] [,trans=<none|lba|auto>] [,werror=<enum>] [,wwn=<wwn>]

Use volume as IDE hard disk or CD-ROM (n is 0 to 3). aio=<io_uring | native | threads>

AIO type to use.

backup=<boolean>

Whether the drive should be included when making backups.

bps=<bps>

Maximum r/w speed in bytes per second.

bps_max_length=<seconds>

Maximum length of I/O bursts in seconds.

bps_rd=<bps>

Maximum read speed in bytes per second.

bps_rd_max_length=<seconds>

Maximum length of read I/O bursts in seconds.

bps_wr=<bps>

Maximum write speed in bytes per second.

bps_wr_max_length=<seconds>

Maximum length of write I/O bursts in seconds.

cache=<directsync | none | unsafe | writeback | writethrough>

The drive’s cache mode

cyls=<integer>

Force the drive’s physical geometry to have a specific cylinder count.

detect_zeroes=<boolean>

Controls whether to detect and try to optimize writes of zeroes.

discard=<ignore | on>

Controls whether to pass discard/trim requests to the underlying storage.

file=<volume>

The drive’s backing volume.

format=<cloop | cow | qcow | qcow2 | qed | raw | vmdk>

The drive’s backing file’s data format.

heads=<integer>

Force the drive’s physical geometry to have a specific head count.

iops=<iops>

Maximum r/w I/O in operations per second.

iops_max=<iops>

Maximum unthrottled r/w I/O pool in operations per second.

iops_max_length=<seconds>

Maximum length of I/O bursts in seconds.

iops_rd=<iops>

Maximum read I/O in operations per second.

iops_rd_max=<iops>

Maximum unthrottled read I/O pool in operations per second.

iops_rd_max_length=<seconds>

Maximum length of read I/O bursts in seconds.

iops_wr=<iops>

Maximum write I/O in operations per second.

iops_wr_max=<iops>

Maximum unthrottled write I/O pool in operations per second.

iops_wr_max_length=<seconds>

Maximum length of write I/O bursts in seconds.

mbps=<mbps>

Maximum r/w speed in megabytes per second.

mbps_max=<mbps>

Maximum unthrottled r/w pool in megabytes per second.

mbps_rd=<mbps>

Maximum read speed in megabytes per second.

mbps_rd_max=<mbps>

Maximum unthrottled read pool in megabytes per second.

mbps_wr=<mbps>

Maximum write speed in megabytes per second.

mbps_wr_max=<mbps>

Maximum unthrottled write pool in megabytes per second.

media=<cdrom | disk> (default = disk)

The drive’s media type.

model=<model>

The drive’s reported model name, url-encoded, up to 40 bytes long.

replicate=<boolean> (default = 1)

Whether the drive should considered for replication jobs.

rerror=<ignore | report | stop>

Read error action.

secs=<integer>

Force the drive’s physical geometry to have a specific sector count.

serial=<serial>

The drive’s reported serial number, url-encoded, up to 20 bytes long.

shared=<boolean> (default = 0)

Mark this locally-managed volume as available on all nodes.

Warning

This option does not share the volume automatically, it assumes it is shared already!

size=<DiskSize>

Disk size. This is purely informational and has no effect.

snapshot=<boolean>

Controls qemu’s snapshot mode feature. If activated, changes made to the disk are temporary and will be discarded when the VM is shutdown.

ssd=<boolean>

Whether to expose this drive as an SSD, rather than a rotational hard disk.

trans=<auto | lba | none>

Force disk geometry bios translation mode.

werror=<enospc | ignore | report | stop>

Write error action.

wwn=<wwn>

The drive’s worldwide name, encoded as 16 bytes hex string, prefixed by 0x.

ipconfig[n]: [gw=<GatewayIPv4>] [,gw6=<GatewayIPv6>] [,ip=<IPv4Format/CIDR>] [,ip6=<IPv6Format/CIDR>]

cloud-init: Specify IP addresses and gateways for the corresponding interface. IP addresses use CIDR notation, gateways are optional but need an IP of the same type specified.

The special string dhcp can be used for IP addresses to use DHCP, in which case no explicit gateway should be provided. For IPv6 the special string auto can be used to use stateless autoconfiguration. This requires cloud-init 19.4 or newer.

If cloud-init is enabled and neither an IPv4 nor an IPv6 address is specified, it defaults to using dhcp on IPv4.

gw=<GatewayIPv4>

Default gateway for IPv4 traffic.

Note

Requires option(s): ip

gw6=<GatewayIPv6>

Default gateway for IPv6 traffic.

Note

Requires option(s): ip6

ip=<IPv4Format/CIDR> (default = dhcp)

IPv4 address in CIDR format.

ip6=<IPv6Format/CIDR> (default = dhcp)

IPv6 address in CIDR format.

ivshmem: size=<integer> [,name=<string>]

Inter-VM shared memory. Useful for direct communication between VMs, or to the host. name=<string>

The name of the file. Will be prefixed with pve-shm-. Default is the VMID. Will be deleted when the VM is stopped.

size=<integer> (1 - N)

The size of the file in MB.

keephugepages: <boolean> (default = 0)

Use together with hugepages. If enabled, hugepages will not not be deleted after VM shutdown and can be used for subsequent starts.

keyboard: <da | de | de-ch | en-gb | en-us | es | fi | fr | fr-be | fr-ca | fr-ch | hu | is | it | ja | lt | mk | nl | no | pl | pt | pt-br | sl | sv | tr>

Keyboard layout for VNC server. This option is generally not required and is often better handled from within the guest OS.

kvm: <boolean> (default = 1)

Enable/disable KVM hardware virtualization.

localtime: <boolean>

Set the real time clock (RTC) to local time. This is enabled by default if the ostype indicates a Microsoft Windows OS.

lock: <backup | block | clone | create | migrate | rollback | snapshot | snapshot-delete | suspended | suspending>

Lock/unlock the VM.

machine: (pc|pc(-i440fx)?-\d+(\.\d+)+(\+pve\d+)?(\.pxe)?|q35|pc-q35-\d+(\.\d+)+(\+pve\d+)?(\.pxe)?|virt(?:-\d+(\.\d+)+)?(\+pve\d+)?)

Specifies the QEMU machine type.

memory: <integer> (16 - N) (default = 512)

Amount of RAM for the VM in MiB. This is the maximum available memory when you use the balloon device.

migrate_downtime: <number> (0 - N) (default = 0.1)

Set maximum tolerated downtime (in seconds) for migrations.

migrate_speed: <integer> (0 - N) (default = 0)

Set maximum speed (in MB/s) for migrations. Value 0 is no limit.

name: <string>

Set a name for the VM. Only used on the configuration web interface.

nameserver: <string>

cloud-init: Sets DNS server IP address for a container. Create will automatically use the setting from the host if neither searchdomain nor nameserver are set.

net[n]: [model=]<enum> [,bridge=<bridge>] [,firewall=<1|0>] [,link_down=<1|0>] [,macaddr=<XX:XX:XX:XX:XX:XX>] [,mtu=<integer>] [,queues=<integer>] [,rate=<number>] [,tag=<integer>] [,trunks=<vlanid[;vlanid...]>] [,<model>=<macaddr>]

Specify network devices. bridge=<bridge>

Bridge to attach the network device to. The Proxmox VE standard bridge is called vmbr0. If you do not specify a bridge, we create a kvm user (NATed) network device, which provides DHCP and DNS services. The following addresses are used:

```
10.0.2.2   Gateway
10.0.2.3   DNS Server
10.0.2.4   SMB Server
```

The DHCP server assign addresses to the guest starting from 10.0.2.15.

firewall=<boolean>

Whether this interface should be protected by the firewall.

link_down=<boolean>

Whether this interface should be disconnected (like pulling the plug).

macaddr=<XX:XX:XX:XX:XX:XX>

A common MAC address with the I/G (Individual/Group) bit not set.

model=<e1000 | e1000-82540em | e1000-82544gc | e1000-82545em | e1000e | i82551 | i82557b | i82559er | ne2k_isa | ne2k_pci | pcnet | rtl8139 | virtio | vmxnet3>

Network Card Model. The virtio model provides the best performance with very low CPU overhead. If your guest does not support this driver, it is usually best to use e1000.

mtu=<integer> (1 - 65520)

Force MTU, for VirtIO only. Set to 1 to use the bridge MTU

queues=<integer> (0 - 64)

Number of packet queues to be used on the device.

rate=<number> (0 - N)

Rate limit in mbps (megabytes per second) as floating point number.

tag=<integer> (1 - 4094)

VLAN tag to apply to packets on this interface.

trunks=<vlanid[;vlanid...]>

VLAN trunks to pass through this interface.

numa: <boolean> (default = 0)

Enable/disable NUMA.

numa[n]: cpus=<id[-id];...> [,hostnodes=<id[-id];...>] [,memory=<number>] [,policy=<preferred|bind|interleave>]

NUMA topology. cpus=<id[-id];...>

CPUs accessing this NUMA node.

hostnodes=<id[-id];...>

Host NUMA nodes to use.

memory=<number>

Amount of memory this NUMA node provides.

policy=<bind | interleave | preferred>

NUMA allocation policy.

onboot: <boolean> (default = 0)

Specifies whether a VM will be started during system bootup.

ostype: <l24 | l26 | other | solaris | w2k | w2k3 | w2k8 | win10 | win11 | win7 | win8 | wvista | wxp>

Specify guest operating system. This is used to enable special optimization/features for specific operating systems: other

unspecified OS

wxp

Microsoft Windows XP

w2k

Microsoft Windows 2000

w2k3

Microsoft Windows 2003

w2k8

Microsoft Windows 2008

wvista

Microsoft Windows Vista

win7

Microsoft Windows 7

win8

Microsoft Windows 8/2012/2012r2

win10

Microsoft Windows 10/2016/2019

win11

Microsoft Windows 11/2022

l24

Linux 2.4 Kernel

l26

Linux 2.6 - 6.X Kernel

solaris

Solaris/OpenSolaris/OpenIndiania kernel

parallel[n]: /dev/parport\d+|/dev/usb/lp\d+

Map host parallel devices (n is 0 to 2).

Note

This option allows direct access to host hardware. So it is no longer possible to migrate such machines - use with special care.

Caution

Experimental! User reported problems with this option.

protection: <boolean> (default = 0)

Sets the protection flag of the VM. This will disable the remove VM and remove disk operations.

reboot: <boolean> (default = 1)

Allow reboot. If set to 0 the VM exit on reboot.

rng0: [source=]</dev/urandom|/dev/random|/dev/hwrng> [,max_bytes=<integer>] [,period=<integer>]

Configure a VirtIO-based Random Number Generator. max_bytes=<integer> (default = 1024)

Maximum bytes of entropy allowed to get injected into the guest every period milliseconds. Prefer a lower value when using /dev/random as source. Use 0 to disable limiting (potentially dangerous!).

period=<integer> (default = 1000)

Every period milliseconds the entropy-injection quota is reset, allowing the guest to retrieve another max_bytes of entropy.

source=</dev/hwrng | /dev/random | /dev/urandom>

The file on the host to gather entropy from. In most cases /dev/urandom should be preferred over /dev/random to avoid entropy-starvation issues on the host. Using urandom does not decrease security in any meaningful way, as it’s still seeded from real entropy, and the bytes provided will most likely be mixed with real entropy on the guest as well. /dev/hwrng can be used to pass through a hardware RNG from the host.

sata[n]: [file=]<volume> [,aio=<native|threads|io_uring>] [,backup=<1|0>] [,bps=<bps>] [,bps_max_length=<seconds>] [,bps_rd=<bps>] [,bps_rd_max_length=<seconds>] [,bps_wr=<bps>] [,bps_wr_max_length=<seconds>] [,cache=<enum>] [,cyls=<integer>] [,detect_zeroes=<1|0>] [,discard=<ignore|on>] [,format=<enum>] [,heads=<integer>] [,iops=<iops>] [,iops_max=<iops>] [,iops_max_length=<seconds>] [,iops_rd=<iops>] [,iops_rd_max=<iops>] [,iops_rd_max_length=<seconds>] [,iops_wr=<iops>] [,iops_wr_max=<iops>] [,iops_wr_max_length=<seconds>] [,mbps=<mbps>] [,mbps_max=<mbps>] [,mbps_rd=<mbps>] [,mbps_rd_max=<mbps>] [,mbps_wr=<mbps>] [,mbps_wr_max=<mbps>] [,media=<cdrom|disk>] [,replicate=<1|0>] [,rerror=<ignore|report|stop>] [,secs=<integer>] [,serial=<serial>] [,shared=<1|0>] [,size=<DiskSize>] [,snapshot=<1|0>] [,ssd=<1|0>] [,trans=<none|lba|auto>] [,werror=<enum>] [,wwn=<wwn>]

Use volume as SATA hard disk or CD-ROM (n is 0 to 5). aio=<io_uring | native | threads>

AIO type to use.

backup=<boolean>

Whether the drive should be included when making backups.

bps=<bps>

Maximum r/w speed in bytes per second.

bps_max_length=<seconds>

Maximum length of I/O bursts in seconds.

bps_rd=<bps>

Maximum read speed in bytes per second.

bps_rd_max_length=<seconds>

Maximum length of read I/O bursts in seconds.

bps_wr=<bps>

Maximum write speed in bytes per second.

bps_wr_max_length=<seconds>

Maximum length of write I/O bursts in seconds.

cache=<directsync | none | unsafe | writeback | writethrough>

The drive’s cache mode

cyls=<integer>

Force the drive’s physical geometry to have a specific cylinder count.

detect_zeroes=<boolean>

Controls whether to detect and try to optimize writes of zeroes.

discard=<ignore | on>

Controls whether to pass discard/trim requests to the underlying storage.

file=<volume>

The drive’s backing volume.

format=<cloop | cow | qcow | qcow2 | qed | raw | vmdk>

The drive’s backing file’s data format.

heads=<integer>

Force the drive’s physical geometry to have a specific head count.

iops=<iops>

Maximum r/w I/O in operations per second.

iops_max=<iops>

Maximum unthrottled r/w I/O pool in operations per second.

iops_max_length=<seconds>

Maximum length of I/O bursts in seconds.

iops_rd=<iops>

Maximum read I/O in operations per second.

iops_rd_max=<iops>

Maximum unthrottled read I/O pool in operations per second.

iops_rd_max_length=<seconds>

Maximum length of read I/O bursts in seconds.

iops_wr=<iops>

Maximum write I/O in operations per second.

iops_wr_max=<iops>

Maximum unthrottled write I/O pool in operations per second.

iops_wr_max_length=<seconds>

Maximum length of write I/O bursts in seconds.

mbps=<mbps>

Maximum r/w speed in megabytes per second.

mbps_max=<mbps>

Maximum unthrottled r/w pool in megabytes per second.

mbps_rd=<mbps>

Maximum read speed in megabytes per second.

mbps_rd_max=<mbps>

Maximum unthrottled read pool in megabytes per second.

mbps_wr=<mbps>

Maximum write speed in megabytes per second.

mbps_wr_max=<mbps>

Maximum unthrottled write pool in megabytes per second.

media=<cdrom | disk> (default = disk)

The drive’s media type.

replicate=<boolean> (default = 1)

Whether the drive should considered for replication jobs.

rerror=<ignore | report | stop>

Read error action.

secs=<integer>

Force the drive’s physical geometry to have a specific sector count.

serial=<serial>

The drive’s reported serial number, url-encoded, up to 20 bytes long.

shared=<boolean> (default = 0)

Mark this locally-managed volume as available on all nodes.

Warning

This option does not share the volume automatically, it assumes it is shared already!

size=<DiskSize>

Disk size. This is purely informational and has no effect.

snapshot=<boolean>

Controls qemu’s snapshot mode feature. If activated, changes made to the disk are temporary and will be discarded when the VM is shutdown.

ssd=<boolean>

Whether to expose this drive as an SSD, rather than a rotational hard disk.

trans=<auto | lba | none>

Force disk geometry bios translation mode.

werror=<enospc | ignore | report | stop>

Write error action.

wwn=<wwn>

The drive’s worldwide name, encoded as 16 bytes hex string, prefixed by 0x.

scsi[n]: [file=]<volume> [,aio=<native|threads|io_uring>] [,backup=<1|0>] [,bps=<bps>] [,bps_max_length=<seconds>] [,bps_rd=<bps>] [,bps_rd_max_length=<seconds>] [,bps_wr=<bps>] [,bps_wr_max_length=<seconds>] [,cache=<enum>] [,cyls=<integer>] [,detect_zeroes=<1|0>] [,discard=<ignore|on>] [,format=<enum>] [,heads=<integer>] [,iops=<iops>] [,iops_max=<iops>] [,iops_max_length=<seconds>] [,iops_rd=<iops>] [,iops_rd_max=<iops>] [,iops_rd_max_length=<seconds>] [,iops_wr=<iops>] [,iops_wr_max=<iops>] [,iops_wr_max_length=<seconds>] [,iothread=<1|0>] [,mbps=<mbps>] [,mbps_max=<mbps>] [,mbps_rd=<mbps>] [,mbps_rd_max=<mbps>] [,mbps_wr=<mbps>] [,mbps_wr_max=<mbps>] [,media=<cdrom|disk>] [,queues=<integer>] [,replicate=<1|0>] [,rerror=<ignore|report|stop>] [,ro=<1|0>] [,scsiblock=<1|0>] [,secs=<integer>] [,serial=<serial>] [,shared=<1|0>] [,size=<DiskSize>] [,snapshot=<1|0>] [,ssd=<1|0>] [,trans=<none|lba|auto>] [,werror=<enum>] [,wwn=<wwn>]

Use volume as SCSI hard disk or CD-ROM (n is 0 to 30). aio=<io_uring | native | threads>

AIO type to use.

backup=<boolean>

Whether the drive should be included when making backups.

bps=<bps>

Maximum r/w speed in bytes per second.

bps_max_length=<seconds>

Maximum length of I/O bursts in seconds.

bps_rd=<bps>

Maximum read speed in bytes per second.

bps_rd_max_length=<seconds>

Maximum length of read I/O bursts in seconds.

bps_wr=<bps>

Maximum write speed in bytes per second.

bps_wr_max_length=<seconds>

Maximum length of write I/O bursts in seconds.

cache=<directsync | none | unsafe | writeback | writethrough>

The drive’s cache mode

cyls=<integer>

Force the drive’s physical geometry to have a specific cylinder count.

detect_zeroes=<boolean>

Controls whether to detect and try to optimize writes of zeroes.

discard=<ignore | on>

Controls whether to pass discard/trim requests to the underlying storage.

file=<volume>

The drive’s backing volume.

format=<cloop | cow | qcow | qcow2 | qed | raw | vmdk>

The drive’s backing file’s data format.

heads=<integer>

Force the drive’s physical geometry to have a specific head count.

iops=<iops>

Maximum r/w I/O in operations per second.

iops_max=<iops>

Maximum unthrottled r/w I/O pool in operations per second.

iops_max_length=<seconds>

Maximum length of I/O bursts in seconds.

iops_rd=<iops>

Maximum read I/O in operations per second.

iops_rd_max=<iops>

Maximum unthrottled read I/O pool in operations per second.

iops_rd_max_length=<seconds>

Maximum length of read I/O bursts in seconds.

iops_wr=<iops>

Maximum write I/O in operations per second.

iops_wr_max=<iops>

Maximum unthrottled write I/O pool in operations per second.

iops_wr_max_length=<seconds>

Maximum length of write I/O bursts in seconds.

iothread=<boolean>

Whether to use iothreads for this drive

mbps=<mbps>

Maximum r/w speed in megabytes per second.

mbps_max=<mbps>

Maximum unthrottled r/w pool in megabytes per second.

mbps_rd=<mbps>

Maximum read speed in megabytes per second.

mbps_rd_max=<mbps>

Maximum unthrottled read pool in megabytes per second.

mbps_wr=<mbps>

Maximum write speed in megabytes per second.

mbps_wr_max=<mbps>

Maximum unthrottled write pool in megabytes per second.

media=<cdrom | disk> (default = disk)

The drive’s media type.

queues=<integer> (2 - N)

Number of queues.

replicate=<boolean> (default = 1)

Whether the drive should considered for replication jobs.

rerror=<ignore | report | stop>

Read error action.

ro=<boolean>

Whether the drive is read-only.

scsiblock=<boolean> (default = 0)

whether to use scsi-block for full passthrough of host block device

Warning

can lead to I/O errors in combination with low memory or high memory fragmentation on host

secs=<integer>

Force the drive’s physical geometry to have a specific sector count.

serial=<serial>

The drive’s reported serial number, url-encoded, up to 20 bytes long.

shared=<boolean> (default = 0)

Mark this locally-managed volume as available on all nodes.

Warning

This option does not share the volume automatically, it assumes it is shared already!

size=<DiskSize>

Disk size. This is purely informational and has no effect.

snapshot=<boolean>

Controls qemu’s snapshot mode feature. If activated, changes made to the disk are temporary and will be discarded when the VM is shutdown.

ssd=<boolean>

Whether to expose this drive as an SSD, rather than a rotational hard disk.

trans=<auto | lba | none>

Force disk geometry bios translation mode.

werror=<enospc | ignore | report | stop>

Write error action.

wwn=<wwn>

The drive’s worldwide name, encoded as 16 bytes hex string, prefixed by 0x.

scsihw: <lsi | lsi53c810 | megasas | megasas-gen2 | mptsas1068 | pvscsi | virtio-scsi-pci | virtio-scsi-single> (default = lsi)

SCSI controller model

searchdomain: <string>

cloud-init: Sets DNS search domains for a container. Create will automatically use the setting from the host if neither searchdomain nor nameserver are set.

serial[n]: (/dev/.+|socket)

Create a serial device inside the VM (n is 0 to 3), and pass through a host serial device (i.e. /dev/ttyS0), or create a unix socket on the host side (use qm terminal to open a terminal connection).

Note

If you pass through a host serial device, it is no longer possible to migrate such machines - use with special care.

Caution

Experimental! User reported problems with this option.

shares: <integer> (0 - 50000) (default = 1000)

Amount of memory shares for auto-ballooning. The larger the number is, the more memory this VM gets. Number is relative to weights of all other running VMs. Using zero disables auto-ballooning. Auto-ballooning is done by pvestatd.

smbios1: [base64=<1|0>] [,family=<Base64 encoded string>] [,manufacturer=<Base64 encoded string>] [,product=<Base64 encoded string>] [,serial=<Base64 encoded string>] [,sku=<Base64 encoded string>] [,uuid=<UUID>] [,version=<Base64 encoded string>]

Specify SMBIOS type 1 fields. base64=<boolean>

Flag to indicate that the SMBIOS values are base64 encoded

family=<Base64 encoded string>

Set SMBIOS1 family string.

manufacturer=<Base64 encoded string>

Set SMBIOS1 manufacturer.

product=<Base64 encoded string>

Set SMBIOS1 product ID.

serial=<Base64 encoded string>

Set SMBIOS1 serial number.

sku=<Base64 encoded string>

Set SMBIOS1 SKU string.

uuid=<UUID>

Set SMBIOS1 UUID.

version=<Base64 encoded string>

Set SMBIOS1 version.

smp: <integer> (1 - N) (default = 1)

The number of CPUs. Please use option -sockets instead.

sockets: <integer> (1 - N) (default = 1)

The number of CPU sockets.

spice_enhancements: [foldersharing=<1|0>] [,videostreaming=<off|all|filter>]

Configure additional enhancements for SPICE. foldersharing=<boolean> (default = 0)

Enable folder sharing via SPICE. Needs Spice-WebDAV daemon installed in the VM.

videostreaming=<all | filter | off> (default = off)

Enable video streaming. Uses compression for detected video streams.

sshkeys: <string>

cloud-init: Setup public SSH keys (one key per line, OpenSSH format).

startdate: (now | YYYY-MM-DD | YYYY-MM-DDTHH:MM:SS) (default = now)

Set the initial date of the real time clock. Valid format for date are:'now' or 2006-06-17T16:01:21 or 2006-06-17.

startup: `[[order=]\d+] [,up=\d+] [,down=\d+] `

Startup and shutdown behavior. Order is a non-negative number defining the general startup order. Shutdown in done with reverse ordering. Additionally you can set the up or down delay in seconds, which specifies a delay to wait before the next VM is started or stopped.

tablet: <boolean> (default = 1)

Enable/disable the USB tablet device. This device is usually needed to allow absolute mouse positioning with VNC. Else the mouse runs out of sync with normal VNC clients. If you’re running lots of console-only guests on one host, you may consider disabling this to save some context switches. This is turned off by default if you use spice (qm set <vmid> --vga qxl).

tags: <string>

Tags of the VM. This is only meta information.

tdf: <boolean> (default = 0)

Enable/disable time drift fix.

template: <boolean> (default = 0)

Enable/disable Template.

tpmstate0: [file=]<volume> [,size=<DiskSize>] [,version=<v1.2|v2.0>]

Configure a Disk for storing TPM state. The format is fixed to raw. file=<volume>

The drive’s backing volume.

size=<DiskSize>

Disk size. This is purely informational and has no effect.

version=<v1.2 | v2.0> (default = v2.0)

The TPM interface version. v2.0 is newer and should be preferred. Note that this cannot be changed later on.

unused[n]: [file=]<volume>

Reference to unused volumes. This is used internally, and should not be modified manually. file=<volume>

The drive’s backing volume.

usb[n]: [host=]<HOSTUSBDEVICE|spice> [,usb3=<1|0>]

Configure an USB device (n is 0 to 4, for machine version >= 7.1 and ostype l26 or windows > 7, n can be up to 14). host=<HOSTUSBDEVICE|spice>

The Host USB device or port or the value spice. HOSTUSBDEVICE syntax is:

```
'bus-port(.port)*' (decimal numbers) or
'vendor_id:product_id' (hexadeciaml numbers) or
'spice'
```

You can use the lsusb -t command to list existing usb devices.

Note

This option allows direct access to host hardware. So it is no longer possible to migrate such machines - use with special care.

The value spice can be used to add a usb redirection devices for spice.

usb3=<boolean> (default = 0)

Specifies whether if given host option is a USB3 device or port. For modern guests (machine version >= 7.1 and ostype l26 and windows > 7), this flag is irrelevant (all devices are plugged into a xhci controller).

vcpus: <integer> (1 - N) (default = 0)

Number of hotplugged vcpus.

vga: [[type=]<enum>] [,memory=<integer>]

Configure the VGA Hardware. If you want to use high resolution modes (>= 1280x1024x16) you may need to increase the vga memory option. Since QEMU 2.9 the default VGA display type is std for all OS types besides some Windows versions (XP and older) which use cirrus. The qxl option enables the SPICE display server. For win* OS you can select how many independent displays you want, Linux guests can add displays them self. You can also run without any graphic card, using a serial device as terminal. memory=<integer> (4 - 512)

Sets the VGA memory (in MiB). Has no effect with serial display.

type=<cirrus | none | qxl | qxl2 | qxl3 | qxl4 | serial0 | serial1 | serial2 | serial3 | std | virtio | virtio-gl | vmware> (default = std)

Select the VGA type.

virtio[n]: [file=]<volume> [,aio=<native|threads|io_uring>] [,backup=<1|0>] [,bps=<bps>] [,bps_max_length=<seconds>] [,bps_rd=<bps>] [,bps_rd_max_length=<seconds>] [,bps_wr=<bps>] [,bps_wr_max_length=<seconds>] [,cache=<enum>] [,cyls=<integer>] [,detect_zeroes=<1|0>] [,discard=<ignore|on>] [,format=<enum>] [,heads=<integer>] [,iops=<iops>] [,iops_max=<iops>] [,iops_max_length=<seconds>] [,iops_rd=<iops>] [,iops_rd_max=<iops>] [,iops_rd_max_length=<seconds>] [,iops_wr=<iops>] [,iops_wr_max=<iops>] [,iops_wr_max_length=<seconds>] [,iothread=<1|0>] [,mbps=<mbps>] [,mbps_max=<mbps>] [,mbps_rd=<mbps>] [,mbps_rd_max=<mbps>] [,mbps_wr=<mbps>] [,mbps_wr_max=<mbps>] [,media=<cdrom|disk>] [,replicate=<1|0>] [,rerror=<ignore|report|stop>] [,ro=<1|0>] [,secs=<integer>] [,serial=<serial>] [,shared=<1|0>] [,size=<DiskSize>] [,snapshot=<1|0>] [,trans=<none|lba|auto>] [,werror=<enum>]

Use volume as VIRTIO hard disk (n is 0 to 15). aio=<io_uring | native | threads>

AIO type to use.

backup=<boolean>

Whether the drive should be included when making backups.

bps=<bps>

Maximum r/w speed in bytes per second.

bps_max_length=<seconds>

Maximum length of I/O bursts in seconds.

bps_rd=<bps>

Maximum read speed in bytes per second.

bps_rd_max_length=<seconds>

Maximum length of read I/O bursts in seconds.

bps_wr=<bps>

Maximum write speed in bytes per second.

bps_wr_max_length=<seconds>

Maximum length of write I/O bursts in seconds.

cache=<directsync | none | unsafe | writeback | writethrough>

The drive’s cache mode

cyls=<integer>

Force the drive’s physical geometry to have a specific cylinder count.

detect_zeroes=<boolean>

Controls whether to detect and try to optimize writes of zeroes.

discard=<ignore | on>

Controls whether to pass discard/trim requests to the underlying storage.

file=<volume>

The drive’s backing volume.

format=<cloop | cow | qcow | qcow2 | qed | raw | vmdk>

The drive’s backing file’s data format.

heads=<integer>

Force the drive’s physical geometry to have a specific head count.

iops=<iops>

Maximum r/w I/O in operations per second.

iops_max=<iops>

Maximum unthrottled r/w I/O pool in operations per second.

iops_max_length=<seconds>

Maximum length of I/O bursts in seconds.

iops_rd=<iops>

Maximum read I/O in operations per second.

iops_rd_max=<iops>

Maximum unthrottled read I/O pool in operations per second.

iops_rd_max_length=<seconds>

Maximum length of read I/O bursts in seconds.

iops_wr=<iops>

Maximum write I/O in operations per second.

iops_wr_max=<iops>

Maximum unthrottled write I/O pool in operations per second.

iops_wr_max_length=<seconds>

Maximum length of write I/O bursts in seconds.

iothread=<boolean>

Whether to use iothreads for this drive

mbps=<mbps>

Maximum r/w speed in megabytes per second.

mbps_max=<mbps>

Maximum unthrottled r/w pool in megabytes per second.

mbps_rd=<mbps>

Maximum read speed in megabytes per second.

mbps_rd_max=<mbps>

Maximum unthrottled read pool in megabytes per second.

mbps_wr=<mbps>

Maximum write speed in megabytes per second.

mbps_wr_max=<mbps>

Maximum unthrottled write pool in megabytes per second.

media=<cdrom | disk> (default = disk)

The drive’s media type.

replicate=<boolean> (default = 1)

Whether the drive should considered for replication jobs.

rerror=<ignore | report | stop>

Read error action.

ro=<boolean>

Whether the drive is read-only.

secs=<integer>

Force the drive’s physical geometry to have a specific sector count.

serial=<serial>

The drive’s reported serial number, url-encoded, up to 20 bytes long.

shared=<boolean> (default = 0)

Mark this locally-managed volume as available on all nodes.

Warning

This option does not share the volume automatically, it assumes it is shared already!

size=<DiskSize>

Disk size. This is purely informational and has no effect.

snapshot=<boolean>

Controls qemu’s snapshot mode feature. If activated, changes made to the disk are temporary and will be discarded when the VM is shutdown.

trans=<auto | lba | none>

Force disk geometry bios translation mode.

werror=<enospc | ignore | report | stop>

Write error action.

vmgenid: <UUID> (default = 1 (autogenerated))

The VM generation ID (vmgenid) device exposes a 128-bit integer value identifier to the guest OS. This allows to notify the guest operating system when the virtual machine is executed with a different configuration (e.g. snapshot execution or creation from a template). The guest operating system notices the change, and is then able to react as appropriate by marking its copies of distributed databases as dirty, re-initializing its random number generator, etc. Note that auto-creation only works when done through API/CLI create or update methods, but not when manually editing the config file.

vmstatestorage: <string>

Default storage for VM state volumes/files.

watchdog: [[model=]<i6300esb|ib700>] [,action=<enum>]

Create a virtual hardware watchdog device. Once enabled (by a guest action), the watchdog must be periodically polled by an agent inside the guest or else the watchdog will reset the guest (or execute the respective action specified) action=<debug | none | pause | poweroff | reset | shutdown>

The action to perform if after activation the guest fails to poll the watchdog in time.

model=<i6300esb | ib700> (default = i6300esb)

Watchdog type to emulate.

## COPYRIGHT AND DISCLAIMER
Copyright © 2007-2022 Proxmox Server Solutions GmbH

This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more details.

You should have received a copy of the GNU Affero General Public License along with this program. If not, see https://www.gnu.org/licenses/

## AUTHOR
Proxmox Server Solutions Gmbh

www.proxmox.com


policyd-spf.conf

package: pypolicyd-spf

title: policyd-spf.conf(5)

text:
# policyd-spf.conf(5)

## NAME
policyd-spf - policyd-spf python configuration parameters

## VERSION
2.0.0

## USAGE
Usage:

policyd-spf [/etc/postfix-policyd-spf-python/policyd-spf.conf]

## OTHER DOCUMENTATION
This documentation assumes you have read Postfix's README_FILES/ SMTPD_POLICY_README and are generally familiar with Sender Policy Framework (SPF). See RFC 7208 for details.

man 1 policyd-spf provides general operation documentation for this package.

man 5 policyd-spf.peruser provides documentation on setting up and using different configuration options on a per user (mail reciepient) basis.

## SYNOPSIS
python-policyd-spf operates with a default installed configuration file and set of default configuration options that are used if the configuration file cannot be found. These options can be changed by changing the installed configuration files or through giving a path to an alternate configuration file.

## DESCRIPTION
Configuration options are described here and in the configuration file provided with the package. The provided setup.py installs this configuration file in /etc/postfix-policyd-spf-python/.

Additionally, whitelisting certain IP addresses from SPF checks is supported. This man page and the sample configuration file show the format to use. These options can be adjusted on a per user (mail recipient) basis. Details on per user settings can be found in policyd-spf.peruser(5).

## LOGGING
"debugLevel" controls the amount of information logged by the policy server.

The default, 1, logs no debugging messages, just basic policy results and errors generated through the policy server. This value can be increased up to 5 (values higher than 5 will not cause an error, but will not log any additional information).

debug level 2 adds a log message if no client address (IP address from which the connection was made), Mail From address, or HELO/EHLO name is received by the policy server, and logs SPF results for each Mail From and HELO check.

debug level 3 generates a log message each time the policy server starts and each time it exits, as well as logging a copy of the exact header returned to Postfix to be prepended into the message. Each time the policy server starts, debug level 3 also logs the configuration information used by the policy server.

debug level 4 logs the complete data set received by Postfix via the policy interface and when the end of the entry is read.

debug level 5 is used to debug config file processing and, for this purpose, can only be set in code and not via the config file. It also provides additional internal status details generally of interest only to developers.

If debug level is 0, then the policy server logs errors only.

When set to -1, nothing is logged once the configuration file has been read in, not even error messages. Use with caution.

Default:

debugLevel = 1

## TEST OPERATION
The policy server can operate in a test only mode. This allows you to see the potential impact of SPF checking in your mail logs without rejecting mail. Headers are prepended in messages, but message delivery is not affected. This mode is not enabled by default. To enable it, set TestOnly = 0.

Note: This option was previously named defaultSeedOnly. This is still accepted, but logs an error.

Default:

TestOnly = 1

## HELO/EHLO CHECKING
HELO check rejection policy options are:

Fail - (Default) Reject only on HELO Fail. HELO/EHLO is known first in the SMTP dialogue and there is no practical reason to waste resources on Mail From checks if the HELO check will already cause the message to be rejected. This should not cause interoperability problems when used for HELO.

SPF_Not_Pass - Reject if result not Pass, None, or Temperror (alternatively put, reject if the SPF result is Fail, Softfail, Neutral, PermError). Unlike Mail From checking, there are no standard e-mail use cases where a HELO check should not Pass if there is an SPF record for the HELO name (transparent forwarding, for example, is not an issue). HELO/EHLO is known first in the SMTP dialogue and there is no practical reason to waste resources on Mail From checks if the HELO check will already cause the message to be rejected. This is not consistent with the RFC 7208 requirement to treat none and neutral the same, but should not cause interoperability problems when used for HELO.

Softfail - Reject on HELO Softfail or Fail. HELO/EHLO is known first in the SMTP dialogue and there is no practical reason to waste resources on Mail From checks if the HELO check will already cause the message to be rejected. This should not cause interoperability problems when used for HELO.

Null - Only reject HELO Fail for Null sender (SPF Classic). This is the approach used by the pre-RFC 4408 reference implementation and many of the pre- RFC specifications. Use of at least this option (SPF_Not_Pass or Fail) are preferred) is highly recommended.

False - Never reject on HELO, append header only. This is useful for post-SMTP spam filters such as SpamAssassin.

No_Check - Never check HELO. This is only recommended if you are calling the policy server twice (once for HELO checks and once for Mail From) with two different configuration files. This approach is useful to get both the HELO and Mail From headers prepended to a message.

Default:

HELO_reject = Fail

## HELO/EHLO PASS RESTRICTION
HELO Pass Restriction allows integration with other Postfix access controls by provding a user supplied name of a postfix access restriction to be applied to a message when the HELO checking result is Pass. The indicated restriction must be an action as defined for a Postfix SMTP server access table access(5) and explained in the Postfix RESTRICTION CLASS README. The README.per_user_whitelisting file provided with this distribution provides examples. Note: A helo pass restriction will be the returned result even if the mail from result would cause the message to be rejected.

Example:

HELO_pass_restriction = helo_passed_spf

Default:

None

## Mail From CHECKING
Mail From rejection policy options are:

SPF_Not_Pass - Reject if result not Pass/None/Tempfail. This option is not RFC 7208 compliant since the mail with an SPF Neutral result is treated differently than mail with no SPF record and Softfail results are not supposed to cause mail rejection. Global use of this option is not recommended. Use per-domain if needed (per-domain usage described below).

Softfail - Reject on Mail From Softfail or Fail. Global use of this option is not recommended. Use per-domain if needed (per-domain usage described below).

Fail (default) - Reject on Mail From Fail.

False - Never reject on Mail From, append header only. This is useful for post-SMTP spam filters such as SpamAssassin.

No_Check - Never check Mail From/Return Path. This is only recommended if you are calling the policy server twice (once for HELO checks and once for Mail From) with two different configuration files. This approach is useful to get both the HELO and Mail From headers prepended to a message. It could also be used to do HELO checking only (because HELO checking has a lower false positive risk than Mail From checking), but this approach may not be fully RFC 7208 compliant since the Mail From identity is mandatory if HELO checking does not reach a definitive result.

Default:

Mail_From_reject = Fail

## Mail From PASS RESTRICTION
Mail From Pass Restriction allows integration with other Postfix access contlols by provding a user supplied name of a postfix access restriction to be applied to a message when the Mail From checking result is Pass. The indicated restriction must be an action as defined for a Postfix SMTP server access table access(5) and explained in the Postfix RESTRICTION CLASS README. The README.per_user_whitelisting file provided with this distribution provides examples. Note: A mail from pass restriction will be the returned result even if the helo result would cause the message to be rejected.

Example:

Mail_From_pass_restriction = mfrom_passed_spf

Default:

None

## Limit Rejections To Domains That Send No Mail
No_Mail - Only reject when SPF indicates the host/domain sends no mail. This option will only cause mail to be rejected if the HELO/Mail From record is "v=spf1 -all". This option is useful for rejecting mail in situations where the tolerance for rejecting wanted mail is very low. It operates on both HELO and Mail From identities if set.

Default:

No_Mail = False

## Domain Specific Receiver Policy
Using this option, a list of domains can be defined for special processing when messages do not Pass SPF. This can be useful for commonly spoofed domains that are not yet publishing SPF records with -all. Specifically, if mail from a domain in this list has a Neutral/Softfail result, it will be rejected (as if it had a Fail result). If needed, it is better to do it on a per-domain basis rather than globally.

Example:

Reject_Not_Pass_Domains = aol.com,hotmail.com

Default:

None

## Permanent Error Processing
Policy for rejecting due to SPF PermError options are:

True - Reject the message if the SPF result (for HELO or Mail From) is PermError. This has a higher short-term false positive risk, but does result in senders getting feedback that they have a problem with their SPF record.

False - Treat PermError the same as no SPF record at all. This is consistet with the pre-RFC usage (the pre-RFC name for this error was "Unknown").

This is a global option that affects both HELO and Mail From scopes when checks for that scope are enabled. The only per scope setting that can over-ride this is Mail_From/HELO_reject = False/

Default:

PermError_reject = False

## Temporary Error Processing
Policy for deferring messages due to SPF TempError options are:

True - Defer the message if the SPF result (for HELO or Mail From) is TempError. This is the traditional usage and has proven useful in reducing acceptance of unwanted messages. Sometimes spam senders do not retry. Sometimes by the time a message is retried the sending IP has made it onto a DNS RBL and can then be rejected. This is not the default because it is possible for some DNS errors that are classified as "Temporary" per RFC 7208 to be permanent in the sense that they require operator intervention to correct.

This is a global option that affects both HELO and Mail From scopes when checks for that scope are enabled. The only per scope setting that can over-ride this is Mail_From/HELO_reject = False/

False - Treat TempError the same as no SPF record at all. This is the default to minimize false positive risk.

Default:

TempError_Defer = False

## Prospective SPF Check
Prospective SPF checking - Check to see if mail sent from the defined IP address would pass. This is useful for outbound MTAs to avoid sending mail that would Fail SPF checks when received. Disable HELO checking when using this option. It's only potentially useful for Mail From checking. SPF Received headers are not added when this option is used.

Prospective = 192.168.0.4

Default:

None

## LOCAL SPF BYPASS LIST
Do not check SPF for localhost addresses - add to skip addresses to skip SPF for internal networks if desired. Defaults are standard IPv4 and IPv6 localhost addresses. This can also be used, to allow mail from local clients submitting mail to an MTA also acting as a Mail Submission Agent (MSA) to be skipped. An x-header is prepended indicating SPF checks were skipped due to a local address. This is a trace header only. Note the lack of spaces in the list.

Default:

skip_addresses = 127.0.0.0/8,::ffff:127.0.0.0/104,::1

## SPF IP WHITELIST
A comma separated CIDR Notation list of IP addresses to skip SPF checks for. Use this list to whitelist trusted relays (such as a secondary MX and trusted forwarders). An x-header is prepended indicating the IP was whitelisted against SPF checks. This is a trace header only. Note the lack of spaces in the list.

Example:

Whitelist = 192.168.0.0/31,192.168.1.0/30

Default:

None

## SPF HELO WHITELIST
A comma separated HELO/EHLO host names to skip SPF checks for. Use this list to whitelist trusted relays (such as a secondary MX and trusted forwarders) or to work around a host with a buggy SPF record. An x-header is prepended indicating the host was whitelisted against SPF checks. This is a trace header only. Note the lack of spaces in the list.

This option includes a check to ensure the connect IP address is referenced in an A or AAAA record by the HELO/EHLO domain that is whitelisted. This is to avoid inadvertent bypass of SPF checks if HELO/EHLO names are forged. If a HELO/EHLO domain is unable to pass such a forward IP address match check, then use an SPF IP Whitelist for the host's IP address instead.

Example:

HELO_Whitelist = relay.example.com,sender.example.org

Default:

None

## SPF DOMAIN WHITELIST
Domain_Whitelist: List of domains whose sending IPs should be whitelisted from SPF checks. Use this to list trusted forwarders by domain name. Client IP addresses are tested against SPF records published by the listed domains. This is useful for large forwarders with complex outbound infrastructures and SPF records. This option is less scalable than the SPF IP Whitelist. An x-header is prepended indicating the IP was whitelisted against SPF checks. This is a trace header only. This option does nothing if the domain does not have an SPF record. In this case use the SPF IP Whitelist described above or Domain_Whitelist_PTR (below). Note the lack of spaces in the list.

Example:

Domain_Whitelist = pobox.com,trustedforwarder.org

Default:

None

## PTR DOMAIN WHITELIST
Domain_Whitelist_PTR: List of domains (and subdomains) whose sending IPs should be whitelisted from SPF checks based on PTR match of the domain. Use this to list trusted forwarders by domain name if they do not publish SPF records. Client IP addresses PTR names are tested to see if they match the listed domains. This is useful for large forwarders with complex outbound infrastructures, but no SPF records and predictable host naming. Matching is done using the same rules as the SPF PTR mechanism as described in RFC 7208. List the parent domain and all subdomains will match. This option is less scalable than the SPF IP Whitelist. An x-header is prepended indicating the IP was whitelisted against SPF checks. This is a trace header only. This option does nothing if the host does not have a PTR record record. In this case use the SPF IP Whitelist described above. Note the lack of spaces in the list.

Example:

Domain_Whitelist_PTR = yahoo.com,yahoogroups.com

Default:

None

## SPF ENHANCED STATUS CODES
By default, Postfix will use the 4/5.7.1 enhanced status code for defer/reject actions from the policy server (originally defined in RFC 1893, RFC 3463 is the current reference). New email authentication (including SPF) specific codes were defined in RFC 7372. The policy server now overrides the Postfix enhanced status codes to use the RFC 7372 values. This can be disabled by setting this option to "No" in the event of interoperability issues.

Example:

SPF_Enhanced_Status_Codes = No

Default:

Yes

## RESULTS HEADER
The standard method for documenting SPF results in a message (for consumption by downstream processes) is the Received-SPF header defined in RFC 7208. This is the default header to use. Results can also be documented in the Authentication-Results header, which is also covered in RFC 7208. The default is Received-SPF (SPF), but inclusion of Authentication-Results (AR) headers as an alternative to Received-SPF can be specified.

If there is a requirement to prepend both Received-SPF and Authentication- Results headers, then it must be done by processing the message with more than one instance of the policy server using different configuration files with different Header_Type settings.

For no header at all, use Header_Type = None.

Examples:

Header_Type = SPF or Header_Type = AR

Default:

SPF

## HIDE RCPT TO IN RESULTS HEADER
Both Received-SPF and Authentication-Results (AR) header fields include the receiving (RCPT TO) address. In this application, it will always be the first recipient sent by the sending MTA, even if that recipient is a BCC recipient. This is unavoidable as the Postfix policy interface does not provide any indication that if the recipient is BCC or not (this information is not available in until after SMTP DATA in the body of the message). This presents a possible avenue for a privacy breach.

In order to avoid this, Hide_Receiver is set to Yes by default in the interest of maximizing privacy. This setting will replace the actual recipient with <UNKNOWN> both in header fields and SMTP responses. The latter may make it more difficult for senders to troubleshoot issues with their SPF deployments. As an implementation detail, currently specifying any value other than No will result in the recipient being hidden, but that may change in the future.

Examples:

Hide_Receiver = Yes or Hide_Receiver = No

Default:

True

## Authentications Results Authentication Identifier
Every Authentication-Results header field has an authentication identifier field ('Authserv_Id'). This is similar in syntax to a fully-qualified domain name. See policyd-spf.conf.5 and RFC 7001 paragraph 2.4 for details. Default is HOSTNAME. The results of socket.gethostname will be used unless an alternate value is specified. An Authserv-Id must be provided if Header_Type 'AR' is used.

The authentication identifier field provides a unique identifier that refers to the authenticating service within a given administrative domain. The identifier MUST be unique to that domain. This identifier is intended to be machine-readable and not necessarily meaningful to users.

Example:

Authserv_Id = mx.example.com

Default:

HOSTNAME

## DNS Timeout Limit
RFC 7208 recommends an elapsed time limit for SPF checks of at least 20 seconds. Lookup_Time allows the maximum time (seconds) to be adjusted. 20 seconds is the default. This limit is applied separately to Mail From and HELO/EHLO checks, so if both are performed, the lookups may take up to twice Lookup_Time (plus any additional time required for whitelisting related DNS lookups).

Example:

Lookup_Time = 20

Default

20 (seconds)

## Whitelist DNS Timeout Limit
Some of the available whitelisting mechanisms, i.e. Domain_Whitelist, Domain_Whitelist_PTR, and HELO_Whitelist, require specific non-SPF DNS lookups to determine if a connection should be white listed from SPF checks. The maximum amount of time (in seconds) allocated for each of these checks, when used (none are enabled by default), is controlled by the Whitelist_Lookup_Time parameter. It defaults to 10 seconds and is applied independently to each whitelisting method in use (e.g. if both a Domain_Whitelist_PTR and HELO_Whitelist are defined, together they may take up to 20 seconds). This is in addition to the time allowed for SPF Lookup_Time.

Example:

Whitelist_Lookup_Time = 10

Default

10 (seconds)

## DNS Void Lookup Limit
RFC 7208 adds a new processing limit called "void lookup limit" (See section 4.6.4). Void lookups are DNS queries within an SPF record for which DNS queries return either a positive answer (RCODE 0) with an answer count of 0, or a "Name Error" (RCODE 3) answer. This should not need to be changed. Although new in an RFC in RFC 7208, this limit has been widely deployed in the Mail::SPF perl library without issue. Default is 2, but it can be adjusted.

Example:

Void_Limit = 2

Default

2

## Mock SPF Check To Add Milter Compatibility Header Field
In some versions of postfix, for bizarre Sendmail compatibility reasons, the first header field added by a policy server is not visible to milters. To make this easy to work around, set the Mock value to true and a fixed header field will be inserted so the actual SPF check will be the second field and visible to milters such as DMARC milter.

To use this feature requires additional postfix configuration to execute the second, mock, instance of the policy server:

Add a second service to /etc/postfix/master.cf:

policyd-spf-mock unix - n n - 0 spawn

user=nobody argv=/usr/bin/policyd-spf '/etc/pypolicyd-spf/mock

Configure the Postfix additional policy service in /etc/postfix/main.cf to run before the regular service:

smtpd_recipient_restrictions =

...

reject_unauth_destination

check_policy_service unix:private/policyd-spf-mock

check_policy_service unix:private/policyd-spf

...

Create the specified configuration file in the location indicated with Mock set to True.

Example:

Mock = True

Default

False

## Reason Message
If a message is rejected or deferred because of the SPF policy, a reason is given for logging and debugging purposes. The String configured supports the following format specifiers:

rejectdefer - either the string 'rejected' or 'deferred' spf - SPF result code

url - Parameterized URL to http://www.openspf.net/ explaining SPF

Example:

Reason_Message = Message {rejectdefer} due to: {spf}.

Default:

Reason_Message = Message {rejectdefer} due to: {spf}. Please see {url}

## SEE ALSO
man 1 policyd-spf, man 5 policyd-spf.peruser, python-spf, <http://www.openspf.net>, RFC 7208, RFC 7001, RFC 7372

## AUTHORS
This version of policyd-spf was written by Copyright © 2007-2016, Scott Kitterman <scott@kitterman.com>. It is derived from Tumgreyspf, written by Sean Reifschneider, tummy.com, ltd <jafo@tummy.com>. Portions of the documentation were written by Meng Weng Wong <mengwong@pobox.com>.

This man-page was created by Scott Kitterman <scott@kitterman.com> and is licensed under the same terms as the program.


policyd-spf.peruser

title: policyd-spf.peruser(5)

text:
# policyd-spf.peruser(5)

## NAME
policyd-spf - policyd-spf python per-user configuration

## VERSION
2.0.0

## USAGE
Usage:

policyd-spf [/etc/policyd-spf/policyd-spf.conf]

## OTHER DOCUMENTATION
This documentation assumes you have read Postfix's README_FILES/ SMTPD_POLICY_README and are generally familiar with Sender Policy Framework (SPF). See RFC 7208 for details.

man 1 policyd-spf provides general operation documentation for this package.

See man 5 policyd-spf.conf for configuration file information.

## SYNOPSIS
python-policyd-spf operates with a default installed configuration file and set of default configuration options that are used if the configuration file cannot be found. These options can be changed by changing the installed configuration files or through giving a path to an alternate configuration file.

Additionally, different configurations can be provided on a per user basis. This man page describes setup and user of per user (mail recipient) configurations. Currently these configurations can only be stored in a text file. If there is sufficient interest, other data storage methods may be supported in the future.

## DESCRIPTION
Use of per-user configuration is defined in the application configuration file with the setting "Per_User". The value of the setting gives the type and location of the per-user configuration information. Currently supported types is text. User is defined an email address of a recipient of the message.

Most options available at the application level (See man 5 policyd-spf.conf) can be adjusted on a per-user basis. Per-user checks can only be done as part of smtpd_recipient_restrictions. Per-user actions are not possible at other stages of the SMTP dialogue. The user is not yet known for smtpd_client_restrictions, smtpd_helo_restrictions, or smtpd_sender_restrictions. If used during smtpd_data_restrictions or smtpd_end_of_data_restrictions, the entire message will be available only if the message was only to a single recipient. If per-user configurations are used when recipient information is not available, warnings will be logged and the per-user information will be ignored.

The following options cannot be modified on a per user basis: Lookup_Time, Header_Type, Hide_Receiver, Authserv_Id, Prospective, debugLevel, and Mock.

In addition to specifying individual users, regular expression matching is also available, but may have performance implications since the entire user table has to be traversed for each message recipient.

## Text Per-User Configuration File
The text file option is useful for testing and when only a small number of users require per-user configurations. It is specified in the main configuration file:

"Per_User = text,/etc/pypolicyd-spf/userconf"

Lines beginning with "#" are treated as comments and ignored. The location of the file is determined by the system administrator. No default file is provided in or installed by the package.

The configuration of the file is a comma separated combination of user and configuration information, with one line per user's configuration information (NOTE: due to man page formatting requirements, these lines may be wrapped in your pager - in the config file, it must be one line per user):

postmaster@example.com,Mail_From_reject=No_Check|PermError_reject=False|HELO_reject=SPF_Not_Pass|TestOnly=1|debugLevel=5|skip_addresses=127.0.0.0/8,::ffff:127.0.0.0//104,::1//128|TempError_Defer=False strict@example.com,PermError_reject=True|HELO_reject=SPF_Not_Pass|TempError_Defer=True

It is not necessary to specify all configuration parameters for each user, only those that are different than the overall configuration need to be specified.

If the specified per user configuration file is missing, an error is logged and the global configuration is used instead.

## SEE ALSO
man 1 policyd-spf, man 5 policyd-spf.conf, python-spf, <http://www.openspf.org>, RFC 7208

## AUTHORS
This version of policyd-spf was written by Copyright © 2007-2016, Scott Kitterman <scott@kitterman.com>. It is derived from Tumgreyspf, written by Sean Reifschneider, tummy.com, ltd <jafo@tummy.com>.

This man-page was created by Scott Kitterman <scott@kitterman.com> and is licensed under the same terms as the program.


cliapp

title: cliapp(5)

text:
# cliapp(5)

## NAME
cliapp - config file and option conventions for Python command line framework

## DESCRIPTION
cliapp is a Python programming framework for writing command line applications for Unix-like operating systems. This manual page describes the conventions for configuration files and command line parsing provided by cliapp.

Configuration file variables and command line options are handled by cliapp under a uniform abstraction: every setting is available both in configuration files and command line options. There are a few settings, provided by the framework itself, which are only available on the command line. For example, --help outputs a short help text, listing all the available options, and --dump-config outputs a list of current configuration settings.

Command line parsing follows GNU conventions: short options start with a single dash, long options with two dashes, and options may be used anywhere on the command line. The order of options versus non-options does not matter. The exception is some of the options provided by the framework, which are executed immediately when found, and may be prevent the rest of the options from being parsed. (--dump-config is one of these, so use it at the end of the command line only.) Use -- on the command line to signal the end of options: no arguments after that are considered to be option.

Some settings may have aliases, which can be only a single character, and in that case they're parsed as single-character option names.

Some applications have subcommands, which means that the first non-option argument is used to tell the application what to do. This is similar to what many version control systems do, for example CVS, svn, bzr, and git. Options are global, and are not specific to subcommands. Thus, --foo means the same thing, regardless of what subcommand is being used.

### Configuration files
Configuration files use INI or YAML file syntax. Files named something.yaml are in YAML syntax. Everything else are in INI syntax. An INI file might look like this:

```
[config]
foo = bar
[extra section]
yo = yoyo
```

The same file in YAML syntax would be:

```
config:

  foo: bar
"extra section":

  yo: yoyo
```

All the settings are in the [config] section. Other sections are allowed, but it is up to the application to give meaning to them.

Multiple configuration files may be read. Settings from later ones override settings from earlier ones. Options override settings from the configuration files.

### String list settings in INI files
Some settings may be a list of values (each value being a string). For example, there might be a setting for patterns to search for, and multiple patterns are allowed. On the command line, that happens by using the option multiple times. In the configuration file, all values are given on one logical line, separated by commas.

This is a non-standard extension to the INI file syntax.

To include an item that itself contains a comma, surround the item with double quotes. There is no way to escape double quotes.

Example:

```
[config]
pattern = foo, bar, foobar, "hello, world"
```

Note than in versions of cliapp prior to 1.20150829, the command line option would also break values with commas. This has since been fixed.

Configuration files in YAML use standard YAML syntax to express lists.

### Expressing sizes in bytes
Some options take a value that gives the size as bytes. These take an optional unit suffix. A plain integer is the size in bytes. The following units are supported:

suffix

meaning

factor

k, kb

kilobyte

10**3

1000

m, mb

megabyte

10**6

1000000

g, gb

gigabyte

10**9

1000000000

t, tb

terabyte

10**12

1000000000000

ki, kib

kibibyte

2**10

1024

mi, mib

mebibyte

2**20

1048576

gi, gib

gibibyte

2**30

1073741824

ti, tib

tebibyte

2**40

1099511627776

Suffixes may be upper or lower case, without change in meaning. Note that "b" and "B" are identical, and both mean byte, not bit.

### Boolean (true/false or on/off or yes/no) settings
When a setting can be either on or off, it's called a Boolean setting. Such settings are turned off by default, and turned on if used on the command line. In a configuration file, they need to be set to a value: if the value is one of yes, on, true, or the number 1, the setting is turned on. Any other value means it is turned off.

```
[config]
verbose = true
attack-kittens = no
```

This turns the verbose setting on, but does not launch attack kittens.

For every boolean setting, two command line options are added. If the setting is called foo, the option --foo will turn the setting on, and --no-foo will turn it off. The negation is only usable on the command line: its purpose is to allow the command line to override a setting from the configuration file.

### Logging and log files
Programs using cliapp automatically support several options for configuring the Python logging module. See the --help output for options starting with log for details. Logging can happen to a file or the system log. Log files can be rotated automatically based on size.

The --trace option enables additional debug logging, which is usually only useful for programmers. The option configures the tracing library for Python, by Lars Wirzenius, which allows logging values of variables and other debug information in a way that is very lightweight when the tracing is turned off. The option specifies for which source code files to turn on tracing. The actual logging happens via the normal Python logging facilities, at the debug level.

### Python profiling support
You can run the application under the Python profiler (cProfile) by setting an environment variable. The name of the variable is FOO_PROFILE, where FOO is the name of the program, as set by the application code or determined by cliapp automatically. The value of the environment variable is the name of the file to which the resulting profile is to be written.

### Manual page generation
cliapp can generate parts of a manual page: the SYNOPSIS and OPTIONS sections. It fills these in automatically based on the subcommand and settings that a program supports. Use the --generate-manpage=FILE option, which is added automatically by cliapp. The FILE is a manual page marked up using the -man macros for troff(1). It should have empty SYNOPSIS and OPTIONS sections, and cliapp will fill them in. The output it to the standard output.

For example:

foo --generate-manpage=foo.1.in > foo.1

You would keep the source code for the manual page in foo.1.in and have your Makefile produce foo.1 as shown above.

### Subcommands
cliapp provides a way for the application to have subcommands, in the style of git(1), for example. If the application is called foo, then it can have subcommands such as foo search, and foo print. The application gets to define the name and meaning of each subcommand. However, all settings (options and configuration files) are global, and can be used with all subcommands. It is up to each subcommand what settings it obeys.

If there are any subcommands, cliapp automatically adds the help subcommand. It allows you to get the help text for a specific subommand: foo help print, for example.

## FILES
cliapp reads a list of configuration files at startup, on behalf of the application. The name of the application is included in the name. In the filenames below, the application name is progname.

/etc/progname.conf

Global configuration file.

/etc/progname/*.conf

More global configuration files. These are read in ASCII sorted order.

~/.progname.conf

Per-user configuration file.

~/.config/progname/*.conf

More per-user configuration files. Again, ASCII sorted order.

In addition, the XDG Base Directory specification is followed, if the Python python-xdg library is installed. In that case, environment variables can be set to set additional location in which files are search for. The fixed names above are always search; the XDG ones are search additionally.


pybugz.d

title: pybugz.d(5)

text:
# pybugz.d(5)

## NAME
pybugz.d - configuration files for pybugz

## SYNOPSIS
/usr/share/pybugz.d/*.conf

/etc/pybugz.d/*.conf

~/.bugzrc

## DESCRIPTION
When started, bugz reads configuration files from all of the locations listed above, in the order listed. In the directories, it reads the files in lexical order.

Files located in /usr/share/pybugz.d/*.conf are provided by pybugz and should not be modified.

Files located in /etc/pybugz.d/*.conf, if it exists, are provided by the system administrator.

The final file that is read, if it exists, is ~/.bugzrc by default. This is the user-specific configuration file. This file name can be overridden on the command line by using the --config-file option.

## CONFIGURATION FILE FORMAT
A configuration file consists of sections which define parameters for the Bugzillas you intend to use. Each section starts with a case-sensitive section name in square brackets and is followed by the settings, in the form "key = value" or "key : value", which define the parameters for this bugzilla instance.

The section name is also the name that should be used with the --connection option of the bugz command or the "connection" setting in the default section of the configuration file.

The section named [default] is special. Any settings defined in this section will have the value they are given here in all other sections unless they are overridden. So, for example, if you want to use the same username for most of your bugzillas, define user in the default section.

Comments are also allowed. A comment must begin with "#" or ";" and be on a line of its own.

## CONFIGURATION SETTINGS
This is a list of the current settings supported by pybugz.

connection = sectionname

This is used in the default section to define the bugzilla you connect with most of the time. It is not an error to put it in another section, but it does not make much sense to do so.

base = http://my.project.com/bugzilla/xmlrpc.cgi

base = http://myhttpname:myhttppasswd@my.project.com/bugzilla/xmlrpc.cgi

This is the base URL of the bugzilla. It must point to the xmlrpc.cgi script on the bugzilla installation. The second form is used if you need to encode a username and password into the URL for basic http authentication.

user = myname@my.project.com

password = secret2

These set your username and password for this bugzilla. If you do not provide one or both of these and you do not use the key setting below, you will be prompted for the setting you do not provide.

passwordcmd = gpg --decrypt ~/.my-encrypted-password.gpg

As another alternative for storing your password, you can provide a password command. This command will be run, and pybugz expects it to output the password to stdout. The example above uses gpg to decrypt an encrypted password stored in a file. The default setting is undefined, so it will not be used unless you define it.

key = string

This is your API key, which is an alternative way to authenticate for Bugzilla 5.0 and newer. To use this, you must generate an API key in the preferences section of Bugzilla and set it to that value. This overrides the username and password settings. The default is undefined.

columns = 80

This is the number of columns your terminal can display. Most of the time, pybugz should be able to determine this value. If it cannot, the default value is 80, so more than likely you will never have to change this setting.

debug = 0

This sets the level of debug logging. This is mostly used for development purposes. It causes PyBugz to print out debugging information as it runs.

quiet = False

If set to true, this requests that pybugz run in quiet mode. This means only output returned from the Bugzilla will be displayed; several more verbose log messages will not be displayed.

product = string

This is the default setting for the product field in bugs in this Bugzilla instance. It is possible to define this in the default section. However, it does not make sense to do so most of the time. If this is set, you will not be prompted for a product when you run bugz post, and this value will also be the default for bugz search.

component = string

This is the default setting for the component field in bugs in this Bugzilla instance. It is possible to define this in the default section. However, it does not make sense to do so most of the time. If this is set, you will not be prompted for a component when you run bugz post, and this will also be the default value for bugz search.

search_statuses = confirmed, in_progress, unconfirmed

This sets the default statuses to be used in a search command. It is a space separated list of Bugzilla statuses.

insecure = true | false

If this is set to true, pybugz will not validate the ssl certificate used during an https connection to this site. Do not use this setting unless you know exactly what you are doing.

## BUGS
The home page of this project is http://www.github.com/williamh/pybugz. Bugs should be reported to the bug tracker there.

## AUTHOR
William Hubbs <w.d.hubbs@gmail.com>


quotagrpadmins

package: quota

title: quotagrpadmins(5)

summary: users responsible for group disk usage

text:
# quotagrpadmins(5)

## NAME
quotagrpadmins - users responsible for group disk usage

## SYNOPSIS
/etc/quotagrpadmins

## DESCRIPTION
The quotagrpadmins file lists administrators of user groups who will receive a warning if warnquota --group command finds a group exceeding its disk usage limits.

Each line consists of a group name followed by a colon and a user name. White space characters surrounding the names are allowed. Empty lines or lines starting with a hash sign or a semicolon are ignored.

## EXAMPLE
\# comment

users: root

## FILES
/etc/quotagrpadmins

list of group administrators

## SEE ALSO
warnquota(8).


quotatab

title: quotatab(5)

text:
# quotatab(5)

## NAME
quotatab - Descriptions of devices with disk quotas

## SYNOPSIS
/etc/quotatab

## DESCRIPTION
The quotatab file lists human descriptions of devices for the purpose of warnquota(8) notifications.

Each line consists of a device path name followed by a colon and a description. White space, apostrophe, and double quote characters surrounding the names and descriptions will be stripped. The description field can encode a new-line as a pipe character.

Empty lines or lines starting with a hash sign or a semicolon are ignored.

## EXAMPLE
\# comment

/dev/sda2: Home directories.|This becomes the second line.

## FILES
/etc/quotatab

list of device descriptions

## SEE ALSO
warnquota(8).


warnquota.conf

title: warnquota.conf(5)

summary: configuration for warnquota

text:
# warnquota.conf(5)

## NAME
warnquota.conf - configuration for warnquota

## SYNOPSIS
/etc/warnquota.conf

## DESCRIPTION
The warnquota.conf file stores a configuration for warnquota(8) tool which is used to notify a user or a group who exceeds its disk quota limits.

The syntax is an option name followed by an equal sign and the option value. White space characters surrounding the option names and values are allowed.

Empty lines or lines starting with a hash sign or a semicolon are ignored.

An option value can but does not have to be quoted. The value can span across multiple lines provided each previous line ends with a backslash.

Some option values can contain formatting sequences which will be expanded to their respective values. Following sequences are recognized:

%d

domain name

%h

host name

%i, %s

user or group name

%%

literal % character

|

new-line character

## OPTIONS
CC_BEFORE

Send to copy-carbon address only when a user has less than specified grace time left. Value is a number followed by a time unit. Known units are seconds, minutes, hours, and days. Example: 5 days

CC_TO

An e-mail address to put into copy-carbon (CC:) recipient header. Default value is root.

CHARSET

Defines character set for sent e-mails. Default value will be current locale character set used when executing warnquota command, if locale is not either C or POSIX. Otherwise no character set will be specified in the e-mails.

FROM

Defines From: e-email address. Default value is support@localhost.

GROUP_MESSAGE

A text sent as an e-mail body if a group exceeds its limits. This option recognizes formatting sequences.

GROUP_SIGNATURE

A signature text appended to notification for a group. Default value is a general explanation utilizing SUPPORT and PHONE values. This option recognizes formatting sequences.

LDAP_BASEDN

Base distinguished name for LDAP queries.

LDAP_BINDDN

Bind distinguished name for LDAP queries.

LDAP_BINDPW

Bind password for LDAP queries.

LDAP_DEFAULT_MAIL_DOMAIN

Default e-mail address domain of searched user if given LDAP attribute does not specify any.

LDAP_HOST

LDAP server name to connect to if LDAP_URI is not defined.

LDAP_MAIL

A boolean controlling if LDAP has to be used to look up user's e-mail address. Possible values are true and false. Default value is false.

LDAP_MAIL_ATTRIBUTE

The LDAP attribute which holds user's e-mail address.

LDAP_PORT

LDAP server port number to connect to if LDAP_URI is not defined.

LDAP_SEARCH_ATTRIBUTE

The LDAP attribute which holds user's ID to look up.

LDAP_URI

The URL of LDAP server to use to search user's e-mail addresses. This option takes preference over LDAP_HOST and LDAP_PORT. Example: ldaps://example.com:389/

MESSAGE

A beginning of text sent as an e-mail body if a user exceeds his limits. This option recognizes formatting sequences.

MAIL_CMD

The command to execute to send an e-mail. The e-mail text including all headers is passed to the standard input of the command. Default value is /usr/lib/sendmail -t.

MAILDEV

The device with disk quotas to exclude from sending notifications if there are exceeded limits. This option should identify the device where mail boxes are stored to prevent from bouncing the warnquota notification by local MDA due to no space for storing new e-mails. Special value any denotes all devices.

PHONE

The telephone contact to the user support. Default value is (xxx) xxx-xxxx or (yyy) yyy-yyyy.

SIGNATURE

The end of e-mail body if a user exceeds its limits. Default value is a general explanation utilizing SUPPORT and PHONE values. This option recognizes formatting sequences.

SUBJECT

The text to put into Subject: header. Default value is Disk Quota usage on system.

SUPPORT

The contact to the user support. Default value is support@localhost.

## EXAMPLE
\# comment

FROM = root@example.com SUPPORT = support@example.com PHONE = 1234

## FILES
/etc/warnquota.conf

configuration for warnquota(8)

## SEE ALSO
warnquota(8).


quvirc

title: quvirc(5)

text:
# quvirc(5)

## NAME
quvirc - The simple configuration file for the quvi program

## DESCRIPTION
A quvi configuration file consists of groups of key-value pairs similar to the so called .ini-like configuration files. quvi uses the GLib to parse the configuration. GLib refers to these files as key files, for lack of a better name.

The lines beginning with a # are considered as comments. You can annotate your configuration file using this character. All text after the comment character to the end of the line is ignored.

GKeyFile has some limitations that should be considered when you use a configuration file to configure quvi.

Multiple keys

Each group in each configuration file may contain the same key multiple times, note however that the last key value replaces the previously defined value.

Multiple groups

Configuration files may contain multiple groups with the same file, they are however, merged together.

The syntax of the configuration file is described in detail in the Desktop Entry Specification at http://freedesktop.org/Standards/desktop-entry-spec

GKeyFile is described in detail in the GLib reference documentation at http://developer.gnome.org/glib/stable/glib-Key-value-file-parser.html

## PATHS
The program will by default search the quvirc file from the typical configuration file paths. These paths (order and location) are determined by GLib, based on how it was configured.

•Print the search paths:

```
$ quvi info --print-config-paths
/usr/share/gnome/quvi/quvirc
/usr/share/gdm/quvi/quvirc
/usr/local/share/quvi/quvirc
/usr/share/quvi/quvirc
/home/legatvs/.local/share/quvi/quvirc
/home/legatvs/.config/quvi/quvirc
```

Each of the same group variable value read from another quvirc replaces the current value. For example:

```
~/.local/share/quvi/quvirc
[core]
stream = foo
~/.config/quvi/quvirc
[core]
stream = bar
```

The program would use "bar" as the core.stream value.

## EXAMPLES
A given quvirc could look like:

```
[core]
check-mode-offline = true
print-format = json
subtitle-language = cc_en,tts_en
stream = 480p,720p,best
#verbosity = debug
[dump]
query-metainfo = true
[exec]
enable-stdout = true
external = echo %t,mplayer %u
[get]
output-regex = %t:/\\w|\\s/,%t:s/\\s\\s+/ /
output-name = %t_%i.%e
resume-from = -1
throttle = 500
[http]
#user-agent = foo/1.0
enable-cookies = true
```

## SEE ALSO
quvi-info(1), quvi-dump(1), quvi-get(1), quvi-scan(1)

## FURTHER RESOURCES
Home

http://quvi.sourceforge.net/

Development code

git://repo.or.cz/quvi-tool.git

gitweb

http://repo.or.cz/w/quvi-tool.git

## AUTHORS
Toni Gundogdu <legatvs@gmail.com>

Author.

## REPORTING BUGS
Report bugs to the quvi-devel mailing list <quvi-devel@lists.sourceforge.net> where the development and the maintenance is primarily done. You do not have to be subscribed to the list to send a message there.

## LICENSE
quvi is Free Software licensed under the GNU Affero GPLv3+

## QUVI
Part of the quvi(1) suite


rabbitmq-env.conf

package: rabbitmq-server

title: rabbitmq-env.conf(5)

text:
# rabbitmq-env.conf(5)

## NAME
rabbitmq-env.conf — environment variables used by RabbitMQ server

## DESCRIPTION
rabbitmq-env.conf contains environment variables that override the defaults built in to the RabbitMQ scripts and CLI tools.

The file is interpreted by the system shell, and so should consist of a sequence of shell environment variable definitions. Normal shell syntax is permitted (since the file is sourced using the shell "." operator), including line comments starting with "#".

In order of preference, the startup scripts get their values from the environment, from rabbitmq-env.conf and finally from the built-in default values. For example, for the RABBITMQ_NODENAME setting, RABBITMQ_NODENAME from the environment is checked first. If it is absent or equal to the empty string, then NODENAME from rabbitmq-env.conf is checked. If it is also absent or set equal to the empty string then the default value from the startup script is used.

The variable names in rabbitmq-env.conf are always equal to the environment variable names, with the "RABBITMQ_" prefix removed: RABBITMQ_NODE_PORT from the environment becomes NODE_PORT in rabbitmq-env.conf.

## EXAMPLES
Below is an example of a minimalistic rabbitmq-env.conf file that overrides the default node name prefix from "rabbit" to "hare".

\# I am a complete rabbitmq-env.conf file.

\# Comment lines start with a hash character.

\# This is a /bin/sh script file - use ordinary envt var syntax

NODENAME=hare

In the below rabbitmq-env.conf file RabbitMQ configuration file location is changed to "/data/services/rabbitmq/rabbitmq.conf".

\# I am a complete rabbitmq-env.conf file.

\# Comment lines start with a hash character.

\# This is a /bin/sh script file - use ordinary envt var syntax

CONFIG_FILE=/data/services/rabbitmq/rabbitmq.conf

## SEE ALSO
rabbitmq-echopid(8), rabbitmq-plugins(8), rabbitmq-server(8), rabbitmq-queues(8), rabbitmq-streams(8), rabbitmq-upgrade(8), rabbitmqctl(8)

## AUTHOR
The RabbitMQ Team <contact-tanzu-data.pdl@broadcom.com>